Merge pull request 'Guard deploy workflow against stale origin on NODA1' (#5) from codex/deploy-origin-guard into main

.gitea/workflows/deploy-node1-runtime.yml

@@ -100,8 +100,11 @@ jobs:
             "${SSH_USER}@${SSH_HOST}" \
             "set -euo pipefail; \
              cd /opt/microdao-daarion; \
+             origin_url=\$(git remote get-url origin 2>/dev/null || true); \
              if [ -n \"\$(git status --porcelain)\" ]; then \
                echo 'WARN: dirty git tree on NODA1; skip checkout/pull and continue with gate'; \
+             elif ! printf '%s' \"\$origin_url\" | grep -Eq 'daarion-admin/microdao-daarion(\\.git)?$'; then \
+               echo \"WARN: origin remote (\$origin_url) is not deploy-safe; skip checkout/pull and continue with gate\"; \
              else \
                git fetch origin; \
                git checkout '${DEPLOY_REF:-main}'; \

docs/ops/deploy_gate.md

@@ -32,6 +32,7 @@ Required repo secrets:
 - `redeploy_runtime=false` only syncs git on NODA1 and runs gate checks.
 - `redeploy_runtime=true` recreates `gateway` and `experience-learner` containers.
 - If NODA1 git tree is dirty, workflow skips checkout/pull and still enforces `phase6_gate` (safe mode for live nodes).
+- If NODA1 `origin` remote is not the expected deploy-safe repo, workflow skips checkout/pull and still enforces `phase6_gate` (prevents accidental downgrade from a stale remote).
 - Workflow uses SSH key validation and `IdentitiesOnly=yes` to avoid host key collisions.
 
 ## Expected PASS

gateway-bot/Dockerfile

@@ -28,7 +28,8 @@ RUN pip install --no-cache-dir \
     pandas \
     openpyxl \
     python-docx \
-    redis==5.0.1
+    redis==5.0.1 \
+    asyncpg>=0.29.0
 
 # Copy gateway code and DAARWIZZ prompt
 COPY . .

gateway-bot/requirements.txt

@@ -1,5 +1,7 @@
 PyYAML>=6.0
 prometheus-client>=0.20.0
 PyPDF2>=3.0.0
+nats-py>=2.6.0
+asyncpg>=0.29.0
 
 crewai